Why can't you see HKCU when connecting to registry remotely?

  • Thread starter Thread starter Mikepiliotis
  • Start date Start date
M

Mikepiliotis

For years I've known that when you open up the registry on a remote
workstation that you can't see the HKCU and I think CLASSES_ROOT, but
I was wondering what the reason was for that? This isn't so much of a
problem as I'm just curious as to why.

Anyone have a quick answer???? Thanks!
 
Those keys are not "real" keys, they're placeholders or "pointers" to
other keys. HKCU points to the looged on SID in HKU. CLASSES_ROOT is a
pointer to HKEY_LOCAL_MACHINE\SOFTWARE\Classes. There are only two
"real" registry keys: HKEY_LOCAL_MACHINE & HKEY_USERS. The other keys
read the information from other places.

John
 
Hi,

HKCU is not a real ken in the sense of the word - it's what is know as a
placeholder (similar to a shortcut) to another location in the registry.

So, on the user's machine, HKCU will actually be a shortcut to
HKEY_USERS\{USER SID} - where user SID is the SID of the logged on user.

You'll see other keys there too, these are other user accounts - for example
on Windows XP you see ones for NETWORK SERVICE etc...

There used to be a good article by Mark Russinovich on the web which
explained the registry in detail - I don't seem to find it now - if I do
I'll post a link to it.

Hope this helps,

Best Regards,
Jon
 
Back
Top